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| Introduction 


.1 Welcome 


hank you for using Data Rescue 3. 


'rosoft Engineering’s Data Rescue is an easy-to-use utility to help you recover files and folders from crashed or corrupter 
ard drives, floppy disks, or removable cartridges. Recovered data is saved to another medium, leaving the original disk 
ntouched. 


.2 What Makes Data Rescue Different? 


he main objective of Data Rescue is that the strategy for finding lost files is different and better from the strategies used 
y other tools. Not only will it find your data in situations where other tools fail, but it will also recover them in a much bette 
ondition, restoring icons, dates and even folder hierarchy. 


lata Rescue is the only utility that focuses on data recovery as opposed to hard drive repair. Your entire hard drive is 
xamined for file content. This is one of the reasons that Data Rescue is more successful than “repair” utilities on the 
iarket. The data on the drive is painstakingly evaluated and files are meticulously re-assembled and stored in a safe 
ycation. Either with intense manual evaluation, or with the help of powerful software tools, this is the process that data 
3covery professionals routinely use to restore their client’s data. 


Vhy? Because this is the only reliable way to safely recover your data. 


.3 Latest Version of the Software 


he downloads section on our web site http://www.prosofteng.com/downloads/ always has the latest version of this 
oftware. If you already have a copy of Data Rescue installed and an active internet connection, Data Rescue will inform 
ou when an update is available when launching the program. If you do not have the latest version of Data Rescue, 
ownload it from the URL above. 


.4 Contact Prosoft Engineering 


Jur technical support is free and can be accessed by email or phone. Please have the version number ready before 
alling: 


support FAQs: _hittp://www.prosofteng.com/support 
=mail Address: support@prosofteng.com 
*>hone Number: 925-426-6306 
ailing Address: Prosoft Engineering, Inc. 
1599 Greenville Road 
Livermore, CA 94550 


Support Hours: Monday — Friday, 7AM — 5PM (PST) 
you have comments or wish to purchase a serial number, please contact our sales department: 


Nebsite: http://(www.prosofteng.com/contact_us.php 
=mail Address: sales@prosofteng.com 
»*hone Number: (877) 477-6763 


.5 About the Demo 
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sensed version would, which will allow you to see all the files that are available for recovery. However, the demo mode 
nly allows you to recover one single file, no larger than 10MB, and limits the number of file previews to 10. 


nce you have confirmed that Data Rescue can indeed see the files that you wish to recover, you can simply purchase a 
opy from http://www.prosofteng.com and a serial number will be immediately sent to you via email. 


.6 System Requirements 


here are two ways to run Data Rescue. You may run it from the boot DVD or you may run it as an application, dependin: 
n your circumstances. 


pplication Requirements: 


e Mac OS X 10.4.11 or later. 

e 512MB RAM minimum, 1GB or more recommended 
e PowerPC G4, G5, or Intel 

e 1GHz processor minimum 

e Asecond drive to recover to*. 


.oot-disc Requirements: 


e DVD drive 

e 512MB RAM minimum, 1GB or more recommended 
e PowerPC G4, G5, or Intel 

e 1GHz processor minimum 

e Asecond drive to recover to*. 


This drive must have free space for recovered files, plus 2% the size of the drive or volume to be scanned. 


1 addition, to run the animated interface requires the following: 


e Quartz Extreme graphics card 
e 32MB VRAM 

e 1GHz CPU 

e 512MB RAM 

e Mac OS X 10.5.x or greater 


the minimum requirements for the animated interface are not met, the program will revert to a non-animated interface. 


.7 General Usage 


lata Rescue was designed to be used in a wide range of situations. Specifically, Data Rescue can handle: 


e Any type of media which appears as a disk device (hard disk, CF camera cards, etc.) 
e Volumes which can’t be mounted, even if the driver is damaged 

e Disks with a damaged partition map 

e SCSI, IDE (also called ATA or PATA drives), SATA, FireWire and USB drives 

e HFS and HFS+ (“Mac OS Extended”) formatted partitions 

e Limited support for non-HFS/HFS+ file systems (FAT32, NTFS, etc.) 

e Large volumes (1 TB and larger) 

e Password-protected volumes (if data is not scrambled/encrypted) 

e Non-Roman-script (e.q Japanese) file names 
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‘e aware that you need disk space on another device for Data Rescue’s temporary working space, and to recover your 
ata. This must be a separate drive from the drive you are trying to recover from, in order to avoid altering that drive. Date 
iescue Offers the most extensive, safe recovery of your important data. Because your corrupt drive is not stable, Data 
‘escue will not allow you to try and save files to the same drive, nor will Data Rescue try and “repair” that corrupt drive 
Joing so could actually cause more corruption and data loss). 


.8 Basic Recovery Tips 


his section will provide you basic tips to help you improve your chances of recovering your data before using Data 
lescue. 


'revent writing to the hard drive. Once you are aware you are missing data, immediately quit all programs you are 
sing and turn off the computer. Further writing to the hard drive may overwrite data you are trying to recover. This 
icludes creating new documents, browsing the Internet, or running disk repair utilities to attempt to fix the drive. 


valuate the situation. Every data recovery scenario is different and may require different approaches to recover the 
ata. Read “Installing and Starting Data Rescue” in chapter 3 to determine the best method for recovering data in your 
ituation. 


. second hard drive with adequate space is necessary to recover data and host Data Rescue’s workspace. If you 
ave a second internal hard drive in your computer or an external USB/FireWire hard drive attached to your computer, yo 
1ay use it for this purpose. Make sure you have enough free space to hold the data you wish to recover, plus an 
dditional amount of 2% the size of the volume or disk being scanned. For example, if you need to recover 25GB of data 
om the bad hard drive, you will need at least 25GB for the recovered files and 0.5GB of free space for the workspace. Ir 
ertain situations, recovered files will require more space than they occupied on the original drive. 


‘onsider acquiring a replacement hard drive. If you do not have a second hard drive to recover to, you may want to 
cquire a new hard drive. If your hard drive is physically failing, a replacement hard drive will be necessary to maintain 
our data. Not only will the new hard drive help you with your recovery immediately, but the new hard drive may also be 
sed as a backup hard drive in the future when your recovery is complete. 


.9 Drives With Suspected Hardware Problems 


ven though Data Rescue exercises caution to never damage your drive’s data by writing to it, there are certain types of 
rive hardware failures which due to their nature can cause additional damage to the media and data just by continuing tc 
se the drive. 


ine example of this kind of damage is a crashed disk head, which could potentially cause additional media scratching an 
ata loss with continued use. One clue to this type of damage may be unusual mechanical sounds emanating from the 
rive. If you suspect this type of damage, and the data on the disk is extremely critical, you may wish to send your drive t 
professional drive recovery service with clean-room facilities. 


he cost of professional recovery services can run into the thousands of dollars. If you suspect hardware damage, but 


eed to avoid the expense of the professional services, you can minimize the chances of further damage to your drive by 
rst cloning it to a spare drive, then do the recovery on the clone. 


.9.1 If your drive is not visible in Data Rescue 
you don’t see your hard drive displayed in Data Rescue’s list of drives, please review the checklist below: 
or external drives: 


e Power cord (if required) is connected to a working outlet 

e Data cable (USB, FireWire, etc.) is connected to a working port 
e Data cable and power cord are known to be in working condition 
e Status lights (if any) are active 
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e Data cable (SATA, etc.) is connected to a working internal slot/port 
e Power cable is connected to a working power supply 


your hard drive is still not visible in Data Rescue or is making clicking noises, there may be a hardware problem affectin 
1e drive from being recognized by the computer. Prosoft Engineering’s The Data Rescue Center may be able to help you 
scover data from your hard drive. 


or Software Technical Support: 


Nebsite: http:/(www.prosofteng.com 
*hone: (925)-426-6306 


o Inquire about Data Recovery Services: 
Nebsite: http:/www. TheDataRescueCenter.com 


*hone: = 1-877-501-4949 
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? Installing and Starting Data Rescue 


his chapter provides basic instructions on installing and starting Data Rescue. If you are using Data Rescue for the first 
me, you should read this chapter in detail. 


1 Install/Uninstall Data Rescue 


you have the Data Rescue bootable DVD, it is not necessary to install Data Rescue and you may boot from the Data 
tescue DVD to run the program. 


you plan on installing Data Rescue to a disk, you should NOT install it on the disk you are trying to recover files from. If 
ou are trying to recover files from a disk that you normally use as a boot drive, you will need to either boot from the Data 
tescue bootable DVD, or else set up a different drive to boot from and install Data Rescue on that drive. You may install 


lata Rescue on your recover / workspace disk and run it from there. It does not necessarily have to be installed on or rur 
om your boot disk. 


he following are instructions for users with a downloaded version of Data Rescue. 


To install Data Rescue: 


1. From the location to which you downloaded Data Rescue, double-click on the Data Rescue image (.dmg) 
file to mount it on your computer. 

2. Drag the contents of the Data Rescue drive (the mounted disk image) to your Applications folder or 
elsewhere, if desired. 


Caution: do not install or copy Data Rescue on (or make any other changes to) a volume from which you 
want to recover files. Doing so may reduce the chances of recovering files from that volume. 


To uninstall Data Rescue: 


1. Drag Data Rescue into the Trash. 


he following are instructions for users using the bootable emergency DVD. Booting from the emergency DVD is ideal for 
ituations where files were accidentally deleted or the operating system fails to boot from the internal hard drive: 
To boot from Data Rescue: 


1. Insert the Data Rescue DVD into the DVD Drive. 
2. Restart the computer holding the “C” key. 
3. Continue holding the “C” key until the Apple logo is displayed. 


'.2 Before you start Data Rescue 
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lake sure the capacity of this drive is great enough to contain all the files you plan to recover from your damaged hard 
rive, plus space for Data Rescue’s workspace files. 


is not recommended to try and use a slow drive such as a network drive, USB 1.0 drive, etc. for temporary storage 
ecause doing so will have a severe performance impact on Data Rescue. 


'.2.1 Note on Data Rescue’s Workspace 


vhat is the Workspace? 


he workspace is a drive, or a folder on a drive, that is used during a scan to store persistent information found during a 
can. 


‘hoosing a Workspace 


‘efore you can perform a scan on a drive, you must choose a workspace location. Once in the Choose Workspace 
findow, you will be presented with a list of all potential workspace locations. By default, the startup drive will be selected 
utomatically if it’s a valid location. 


alid and Invalid Workspace Locations 
lot all locations will be valid choices. A potential location must: 


e be located on a separate physical drive from the drive selected for scanning 

e contain a valid Mac OS Extended file system (HFS+) with write-access (see below) 

e have enough free space to store information about the drive selected for scanning. This value is estimated to be 
2% of the selected drive’s capacity. 


rasing a non-Mac Location 


a location selected is not a valid Mac file system, Data Rescue can erase it so that it can be used as a workspace 
ication if it’s identified as “erase required”. In this situation you can select the location and click Choose. A Erase window 
‘ill be displayed to confirm the operation. Once erased, you can go back to the Choose Workspace window and re-selec 
1e location once again. Please note, erasing a volume will destroy all file data on it. This feature is most often used for 
then a new drive is purchased from a retail store and is not properly formatted for use with a Mac. 


Choose a workspace 


Data Rescue 3 requires temporary storage on a fully functional drive to use during a scan. This Is called the 
workspace. 


Select a location to use from the list below. 


& Macintosh HD (contains 7 existing scans) 


h Mac Boot (contains 1 existing scan 
< 
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'.3 Starting Data Rescue 


aunch the application by double-clicking the Data Rescue icon in the Data Rescue folder. If Data Rescue has not been 
Jn before, an authentication window will be displayed. This prompt authorizes Data Rescue to access your disk devices 
ith special privileges. 


Type your password to allow Data Rescue 3 to 
make changes 


Authentication Window 


‘nter the username and password of an Administrative user. (If you are the only user of your system, then you are most 
<ely the administrative user, and you can use your own name and password.) If you do not have an administration 
assword for your computer, please contact your system administrator to log in for you. 


3.1 Selecting the Home Folder on the Boot DVD 


you are running Data Rescue from the boot DVD, it will ask you to select the Home Folder at startup. The Home Folder 
; a location that you must provide only when booting from its startup DVD. It is used to store preferences, registration, 
ilelQ settings and more. 


lsually when Data Rescue is used from the startup disk as a normal application, it can use the user’s home folder (e.g. 
Jsers/you/) as the home folder. However this option is not available when booted from the DVD, which is read-only, so 
ou must provide Data Rescue this location instead. 


ienerally, you should select a folder on a separate physical drive from the drive that you want to scan. If you use the driv 
ou want to scan you could potentially damage the possibility of a full recovery. 


lata Rescue will provide you with a list of potential locations for the Home Folder. If a folder contains a name below it, 
1en this means that that folder has a valid registration file and is most likely the home folder you should choose. 


you are unsure of what to use, choose Skip and Data Rescue will use a temporary location that will be erased once the 
omputer restarts. This temporary location is stored in memory and will not affect any attached hard drives. 


‘ Choose Home Folder | 


F Welcome to the Data Rescue 3 Boot DVD 


Choose a Home Folder 


Before you begin using Data Rescue 3, select a location for the Home Folder. The Home Folder is where preferences, registration, 
and FilelQ settings are stored. Learn more. 


Choose a Hone Folder above to begin. Do not select a drive you want to scan. If you're unsure, choose 
Skip and a temporary location will be used instead. 


Choosing a Home Folder 


fter clicking the OK button and Data Rescue has not been activated yet, an activation window will appear. 


Please activate your copy of Data Rescue 4. 
mime (_d 


Serial Number 7 


( Cancel ) ( Demo ) 
Data Rescue Activation Window 


you have a serial number, enter your name and serial number information and click on Activate to enable the full 
atures of the software. If you are sampling Data Rescue, click on the Demo button. In Demo mode, Data Rescue will 
llow you to scan the drive, but you will only be able to recover one file of 10MB or less. 


fter the Activation window, you will be shown the Welcome window. The Welcome window provides quick access to 
ommonly used features. Choose Start New Scan to begin scanning a drive. This will be the main option for the majority « 
sers. If you have already completed a scan, you can choose Browse Completed Scans to go to the Scan Results and 
nd files for recovering. Lastly, if you have a scan that was suspended (paused), you can resume it with the Resume 
‘uspended Scan option. 
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} Using Data Rescue 
1.1 Welcome to Data Rescue 


ane Data Rescue 3 


—————— 


Welcome to Data Rescue 3 


Welcome to Data Rescue 3 


Do-it-Yourself Data Recovery Software 


Start New Scan 
Begin the process of scanning a drive 


€ Resume Suspended Scan 


Browse Completed Scans 


Welcome to Data Rescue 3. Please choose an option above to get started. 


Welcome to Data Rescue 


‘tart New Scan 
‘hoose this option if you want to begin scanning a drive. This will be the case for the majority of users who haven’t used 
lata Rescue before. 


'esume Suspended Scan 

you have suspended a previous scan, you can use this option to continue where you last left off. Make sure you have 
1e Original drive that was being scanned connected to your computer. If you only have one suspended scan, it will be 
sumed immediately. Otherwise you will be prompted to choose a scan to resume. 


irowse Completed Scans 
his option is available if you already have one or more completed scans. Selecting this will bring you to the Scan Result: 
here you can locate files for recovery. 


1.2 Step 1: Selecting a Drive or Volume to Scan 


he first step is to select the hard drive or volume that is missing the files. This step shows a list of all the disk drives and 
olumes that Data Rescue can see on the system. 


To select the drive or volume: 


1. Click on the hard drive or volume icon. 
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lata Rescue shows a two-level list of all the disk drives and volumes. The first level shows the hardware names of the 
‘hole drive, which may include the make and/or model of the hard drive. This will scan the entire hard drive with any 
artitions. 

he second level shows the volumes that belong to the hard drive. In most cases, you will want to select the volume first 
is available. Volumes that are not mounted will be listed with a gray (dimmed) font. Although this may indicate volume 
orruption, the volume may be selected to be scanned. 

he following lists will help you determine what to select based on your situation. 

‘elect the hard drive name if: 


e The volume is not listed 
e The hard drive was reformatted or repartitioned 
e No data is found by a Quick Scan on the volume 


‘elect the volume name if: 


e You are looking for deleted files 
e The volume failed to mount, but shows in the list 


1.3 Step 2: Choose a Task 


he second step is to select the task to perform on the volume or hard drive. This step will let you choose to scan or clon 
our volume or hard drive. 


To choose a task: 


1. Click on the icon for the task you would like to perform. 
2. Click on the Start button. Wait for the Scan process to complete. 


lata Rescue provides a variety of functions to help search for the data on your hard drive. Each scan method is designec 
» help recover different scenarios. See the tasks section for more information. 


3.1 Canceling a Scan 


Ca n ce | Do you want to stop the current operation? 


Cancel to abandon the current operation ¢ Choose End Early 


ed with what has been found so far. Choo: to continwe later 


( Cancel _) 


Cancel Confirmation Prompt 


fter clicking the Start button, Data Rescue will begin its scan process on the hard drive. You may interrupt the scan 
rocess at any time by pressing Cancel. A prompt will confirm if you want to cancel the process. To cancel the scan in 
rogress, click on the Cancel button in the prompt. To close the prompt and return to the scan, click on the Continue 
utton. If you are using a Deep Scan or Deleted Files Scan, the confirmation prompt will have two additional choices for 
iuspend and End Early. 


‘electing the Suspend option will save your current progress, allowing you to continue the scan where you left off later 
n, even if you have quit Data Rescue or rebooted your system in the meantime. This is a helpful option if you have to 
»mporarily stop the scan and continue at a later time. Suspended scans can be reloaded later through the Manage 
‘cans selection in the File menu. See the Manage Scans section for more information about loading suspended scans. 


electing the End Early option will force Data Rescue to end its current scan and provide results up to that point of the 
can. This is a helpful option if you are having difficulties scanning a hard drive due to bad blocks or slow reads. Please 
ote that ending the scan early will end only the first phase of Data Rescue’s scan process, and will still progress through 
1e next two phases of the scan process to catalog the results. The results from the ended scan may take up to an hour t 
rocess. Allow adequate time for the results to be processed. 


1.4 Step 3: Find and Mark Files 


Step 3 of 3: Find and Select Files 
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Scan Results 


Q- 
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ompleted ¥ @ Pictures HD 9/8/09 9-02-19 Pm 
com. apple timemachine.do 8/31/09 9:59:25 AM O bytes 
com.apple.timemachine.su 10/29/07 2:55:49 PM O bytes 
OS Store 8/25/09 8:20:35 AM 15 KB 
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@ Backup 12/19/08 7:00:31 PM 


Select files and folders to recover. To recover multiple files of folder, check the boxes 


Scan Results Window 


he third step is to mark the files and folders to be recovered. Marking a folder will automatically mark all the files and 
ders contained within the folder. 


lata Rescue will organize files into two different folders: Found Files and Reconstructed Files. The files found by Data 
lescue will be organized depending on the scan method you use. 


ound Files will be listed in the results window when using a Quick Scan or Deep Scan. Found Files displays any files 
om any file systems it detects, listing original directory structures and file names. You will want to look through the Foun 
iles results if you are recovering from a hard drive that has failed to boot to the operating system or if your external hard 
rive is failing to mount. 


‘econstructed Files will be listed in the results window when using a Deep Scan or Deleted Files Scan. The 
‘econstructed Files results will organize any found files by category and file type. These results will NOT have their 
riginal directory structure and will usually not have their original file names since they are found by file patterns. You will 
rant to look through the Reconstructed Files results if you are recovering from a hard drive that was accidentally 
formatted or had files that were accidentally deleted. 


Ve do not generally recommend selecting and recovering all of the Found and Reconstructed files simultaneously, 
specially from a Deep Scan. It is generally better to spend a little time to select and recover just the files and folders you 
rant. For example, Deep Scans typically contain huge amounts of Mac OS files and folders that will not be useful when 
2covered, and will just increase the time and space needed for the recovery. You can browse and/or use the search 
ature to help locate files you are interested in. 


1 addition, if you intend to recover many files under Found Files, we recommend that you start by recovering a few 
nportant files first, then verify that the files open properly before recovering the rest of the listed files. 


4.1 Previewing Files 
lata Rescue allows you to preview major file types before recovering the files. This will help determine whether the files 


an be recovered properly before being transferred onto another hard drive. Major file types such as .doc, .pdf, .mp3, anc 
peg can be previewed through Data Rescue. 
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Preview Window 


To preview files within Data Rescue: 


1. Click on a file’s name within the list to highlight it. 
2. Click on the Preview button or press the space bar on the keyboard to view a thumbnail of the image or an 
overview of the document. 


S a convenience to the user, double-clicking on a file in the Scan Results window will cause the file to be temporarily 
3covered into Data Rescue’s workspace and the operating system will open the file with the appropriate application. For 
xample, double-clicking on a .mov movie file will open the default media player application, typically QuickTime. This 
ouble-click preview feature is only available while booted directly from the operating system. The double-click preview is 
isabled in Demo mode and when booted from the DVD. 


To preview files within their default application (while booted from the operating system): 


1. Double-click on the file you want to preview. 


4.2 Searching the Scan Results 


he search feature will allow you to quickly filter your results and find your most important files. If you are looking for a 
pecific file, you may use the Search Field in the Scan Results window or click on the Edit menu and select Find. 


Step 3 of 3: Find and Select Files 


= from Quick Scan en "Puctures HD" 
Scan Results P = 
Q jpg Search 
———————————————— 
Sant Mare Name Parent Oate Size 
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nd folders to recover. To recover multiple files or fold 


Search Results Window 
he Search Field in the Scan Results window can be used to quickly filter the results for specific filenames or extensions. 


he Scan Results window will be updated with any files that match the extension or word within the filename. Highlightinc 
file from the list will display the path to the file on the bottom half of the window. Please note the Search feature does 


|OT look within the contents of the files for Keywords. 


To use the Search Field: 


1. Click in the Search Field and type in a file name or extension. 
2. Press the Return key on the keyboard, or click on the Search button. Allow adequate time for the results to 


filter and update the list. 


he Find feature in the Edit menu allows you to search for specific criteria of a file, including file name, date created, and 
le size. This allows you to filter out a range of files if you remember the date created or file size. 


SS 


_) Search selected folder only € @ne 


Find Window 


To use Find feature: 


1. Click on the Edit drop down menu and select Find. 
2. Optionally, check Search selected folder only to only search the selected folder. 
3. Select the parameters for the file you are trying to find and click on Search. 
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nd selecting Scan Results. Any files marked for recovery in the Search results will remain marked for recovery when 
turning to the Scan Results. 


1.4.3 Recovering Files 


Vhile previewing the files, you may begin marking any files to recover. You may choose to recover each file individually o 
1 groups by marking multiple files and pressing the Recover button, or dragging and dropping files into a Finder window 
) recover them to the destination hard drive. 


fter completing a scan and before recovering a large number of files, it is highly recommended to first try and recover 
nly a few of your important files to make sure they contain good data. There are some situations where there can be 
ncertainty about the proper Allocation Block Layout choice section for more information about Allocation Block Layouts). 


ipecific files can be marked for recovery by using the checkboxes within the Scan Results list. This allows you to choose 
iultiple files throughout the scan results to be recovered as one process. If you would like to recover all the possible 
2sults from your hard drive, you can mark the root selections Found Files and Reconstructed Files, however it is general 
est to select specific files and folders you want to recover to save time and hard drive space. 


To recover files using the checkboxes: 


1. Click on the checkboxes to mark any files you are interested in recovering. 

2. Click on the Recover button. 

3. Select the destination for your files to be transferred to and click on Open. Allow adequate time for the files 
to be transferred onto the destination. 


he “drag and drop” recovery process is the quickest way to move a file or folder to the destination hard drive if you are 
ooted from your operating system. However, this method of recovery is not available while booted from the DVD since 
1e Operating system’s Finder windows are not available to drag to a destination. 


To recover files using the drag and drop method: 


1. Highlight the file or folder you want to recover. 
2. Click and drag the highlighted file or folder from the Scan Results list onto the destination hard drive or 
folder on Apple’s Finder. Allow adequate time for the files to be transferred onto the destination. 
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| Tasks 
1.1 Quick Scan 


‘elect the Quick Scan if: 


e Adrive’s operating system fails to boot. 
e An external drive fails to mount. 


he Quick Scan is the fastest method that detects existing directory structures even if your volume does not mount. This 
can will detect files with their original folder hierarchies and file names. It is recommended to try this scan method first if 
our volume is detected on the hard drive. 


.Quick Scan can only be used on a volume. If you have selected the hard drive to be scanned, the Quick Scan will 
ttempt to search for the first available volume on the hard drive, then rebuild the directory structure for that volume. 


he Quick Scan typically takes a few minutes to complete, but may take up to a few hours to retrieve the results in more 
evere cases. Bad blocks on the hard drive may slow down the scan process, but will immediately speed up once it has 
vercome those bad blocks. 


|.2 Deep Scan 


‘elect the Deep Scan if: 


e No volumes are detected on the hard drive. 
e Ahard drive was reformatted. 
e The Quick Scan did not provide expected results. 


he Deep Scan is a comprehensive scan method that provides the most results possible. The Deep Scan is a two part 
can method: 1) detects existing directory structures on the hard drive, 2) scan the whole hard drive for any file patterns t 
build the raw data of any recognized files. 


S the first part of the scan, Deep Scan will detect any existing directory structures like the Quick Scan, but can detect 
iultiple directory structures while scanning hard drive with more than one volume. This will provide you with results from 
ach found volume, with their original directory structures and file names. 


he second part of the Deep Scan searches the entire hard drive for any files based on file patterns. Data Rescue detect: 
ver 150 major file types based on the files’ raw data. These found files will not have their original directory structure or 
lenames since Data Rescue is rebuilding the files based on their file design. Instead, these results will be provided with 
eneric filenames and organized by category in the Reconstructed Files folder. 


he Deep Scan usually takes up to three minutes per gigabyte. With large capacity hard drives, it may require several 
ours to complete a scan. Physical issues such as bad blocks on the hard drive may slow down the scan process even 
ynger, but the scan will immediately speed up once it has overcome the bad blocks. Allow adequate time for the scan to 
nish. 


L.3 Deleted Files Scan 


‘elect the Deleted Files Scan if: 


e Files were deleted through the operating system. 
e Files were deleted by another program. 
e A fresh installation of an operating system overwrote an existing hard drive 
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atterns. Scanning only the free space allows the Deleted Files Scan to specifically detect any files that were deleted. 


)nce files are deleted through the Mac Operating System, there is no more reference to their original directory structure, 
lename, or date created/modified. Data Rescue will not be able to detect the original information of that file in the 
irectory structure. Instead, Data Rescue will rebuild any files that it detects based on its file patterns. The results of the 
leleted Files Scan will be provided with generic filenames and organized by category in the Reconstructed Files folder. 


he Deleted Files Scan usually takes up to three minutes per gigabyte of free space available on the volume. This makes 
1e Deleted Files Scan faster than a Deep Scan since it is not scanning any known used space on the volume. 


1.4 Clone 


‘elect the Clone feature if: 


e The hard drive appears to be having some hardware problems 
e Quick or Deep Scans are stating an excessive amount of time to scan 
e You need an identical copy of the hard drive 


he purpose of the Data Rescue cloning function is to copy a drive or volume to another drive or volume, so that the copy 
vay be scanned, reducing the wear-and-tear on the original hard drive. This will free the hard drive from use while 
reserving the data that was on it for later scanning. Cloning is normally not required in order to scan and recover files wii 
lata Rescue. The goal is to transfer all the data from the source to the destination, making a perfect one-to-one copy 
there it is possible. In some cases, due to disk errors on the source, copying can be hindered to the point where getting : 
erfect 100% is not possible because of the huge slowdown in read rate caused by errors; then the goal becomes 
ansferring as much of the source data to the destination as possible within a certain time period. 


o use the Clone feature, a spare hard drive is needed with the same or larger capacity than the original hard drive. The 
‘lone feature makes a single pass copy of your hard drive onto another hard drive or into a disk image. Please note the 
loned hard drive will be in the same logical state as the original hard drive. This means if the original hard drive is failing 
) mount or boot, the cloned hard drive will have the same failure to mount or boot. The purpose of the clone is to help 
vercome any slow reads or possible hardware failures that exist on the original hard drive. 


the original hard drive appears to have hardware problems, it is highly recommended to clone the hard drive first to 
3duce the use of the source drive while it is still operating. Once the original hard drive is cloned, you may put the origin 
ard drive away for safekeeping and perform the recovery options on the cloned hard drive. 


To Clone a hard drive: 


1. Select the device level of the hard drive in Step 1. 

2. Select the Clone task in Step 2. 

3. Select the Clone Target where the hard drive will be cloned to and click on Start Clone. Wait for the clone 
process to complete. 


‘loning the device level will copy the entire hard drive’s partition map onto the other hard drive. If there are multiple 
artitions on the hard drive, the partitions will be cloned onto the destination as well. You may select and clone volumes 
ather than the whole hard drive; however, this is only recommended if you are instructed by Prosoft technical support or 
ou have knowledge and experience about disk partitions and volumes. 


Warning: The Clone process will overwrite the contents of the Clone Target. Ensure you have a backup of 
the contents of the Clone Target hard drive, or use an empty hard drive. Be extremely careful to choose the 
target so that you don’ write to the wrong drive or volume. 


To Clone to a disk image: 


. Select the device level of the hard drive in Step 1. 

. Select the Clone task in Step 2 and click on Continue. 

. Select New Disk Image as the Clone Target. 

. Aprompt will appear to title the saved disk image. Give a title to the disk image and select the destination 
for the disk image file and click Save. 

5. Click on Start Clone. Allow adequate time for the clone process to complete. 
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‘loning to a disk image will allow you to save the entire contents of a hard drive into a single file. This is a good option if 
ou have available hard drive space, but do not want to erase the contents of another hard drive. The disk image can be 
pened later to help simulate the original hard drive and complete a scan for recovering files. 


|.5 FilelQ 


‘elect the FilelQ feature if: 


e A file type you are searching for is not found 
e You have a special file type that is not supported by Data Rescue 
e You want to check if a file type is supported 


Data Rescue does not recognize the file type you are trying to recover, FilelQ will help Data Rescue to learn new file 
‘pes. Data Rescue will analyze any good working file samples and detect any file patterns to help find missing files of the 
le type. FilelQ will work for many, but not all types of files. However, Data Rescue will tell you if your sample files are 
<ely to work or not, and there is nothing to lose by trying. 
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Show advanced options 


- Drag sample files abowe to begin aradynis 


FileiQ is a powerful featere which enables Data Rescue 3 to learn mew file types. Simply drag sample Piles to the 
Data Retcue 3 Grop-in bin and Data Rescue 3 will learn these mew Pile types 
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Filel(Q Window 


To add a new file type into Data Rescue: 


Click on the + icon to add file samples. 

Choose any at least 5 files of the same file type. 
Click on Open to add the files into the list. 

Click on Save. 


Cigar Og ee 


o utilize FilelQ, Data Rescue needs to analyze good working files of the same file type that is missing. These may be 
Ider files that you have previously created with your program. You will usually need to reference at least 5 files of the 
ame filetype to properly create a file module; however in some cases, as few as two files may work. In general, the more 
le samples provided into FilelQ, the more accurate the created file module will be. If you do not have sample files 
vailable, you may consider creating some files of the same file type with the program used to make the files. However, 
nsure these files are not saved to the hard drive missing the data. 


‘lick on the + icon or drag the sample files into the Add New Type window. A spinning progress wheel will appear below 
1e list to indicate the files are being analyzed. If no additional information is reported back in Data Rescue, you may click 
n Save to add the file module to the Learned Types List. 


5.1 FilelQ Advanced Options 


‘how advanced options displays some additional parameters that you may use to further define the file module. 


he Details tab includes some fields to describe the file type, how the file names will be generated, and which folder they 
‘ill appear in. Data Rescue will automatically fill in most of the fields when sample files are listed in FilelQ. Data Rescue 
‘ill fill in the Template File name, Extension, Folder Name, and Max File Size based on the sample files’ data. The fields 
till define the following attributes for the file module: 


e Name is an optional field that you may fill in to describe the File module. This will be displayed in the Preference’s 
Scan Engine Tab. 

e Template File Name is the generic name that will be provided to any found files. 

e Extension is the file type determined by the file samples. 

e Folder Name is the location where the found files will be displayed in the scan results list. 

e Max File Size limits the size of the data captured for the file. Ideally this should be large enough that you are sure 
all files of this type are smaller than this limit. If in doubt, you may make this value larger because files larger than 
this number will either not be found or will be truncated when recovered. If you do not specify a value for Max File 
Size, Data Rescue will choose a value that is about 10 times larger than the largest file sample you added. 


he Quality tab will display two scales to detect the file patterns reliability for the file module. Diversity relates to how 
vany samples there are and how many samples have different lengths. The Match Strength displays the number of 
imilar bits found between the separate files. Data Rescue will update these bars each time a sample file is added or 
3moved. The larger the values are for both Diversity and Match Strength, the more reliable the file module will be for Dat 
iescue to detect the files. 


you’re having trouble getting an acceptable set of samples, it is best to remove all the sample files and add them one al 
time. You can improve the Diversity by adding another sample file. If the Match Strength suddenly decreases when you 
dd another sample file, it may be because that file is actually different in format than the samples you already added. In 
iat case, remove that file and adding a different one. Please remember that certain types of files do not have distinctive 
tarting patterns, and therefore will not be recoverable by example at all, not matter what combination of samples you 
ive. If you find that you cannot get both Diversity and Match Strength above half-way, see the next section on 
oubleshooting. 


he Pattern tab allows you to modify the matching algorithm. The Matching drop down menu instructs Data Rescue how 
elective to be in matching start patterns for the file type. The default selection for Normal will give a basic comparison of 
1e bits to determine the file pattern. If your scan returns too many files that are not similar to the filetype, you may chang 
1e Matching selection to Tight. This will make Data Rescue compare more bits in the file pattern to potentially detect the 
les more accurately and reduce the amount of results provided. If your scan returns too few files, you may change the 
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Data Rescue determines that the sample files have a usable and consistent end pattern, it will use enable the Use End 
‘attern option. Using an end pattern should result in recovered files that have the correct length, instead of potentially 
dding incorrect data. However, enabling the Use End Pattern option may reduce the scan performance considerably anc 
ay take longer to complete the scan. If you uncheck the Use End Pattern option, the end pattern will not be used for the 
can. 


lata Rescue currently does not support editing previously saved definitions. To change the Matching selection, you will 
ave to recreate the FilelQ definition and save the different matching selected. 


nce you click Save, new file types will immediately be installed in Data Rescue to allow you to search for their respectiv 
les. 


5.2 FilelQ Troubleshooting 


fter dragging the sample files, you may be provided with a few different outcomes. This section discusses some cases 
vat may occur while trying to generate a file module. 


he file samples may be recoverable by an existing module. If a file module is listed in the “Recoverable by Existing 
lodule” field, then it may not be necessary to create a file module. This means the file samples you have provided are 
imilar to another file module that Data Rescue already detects. The results you are provided by a scan may already 
etect your files, but you may need to rename the extension to open the files properly by your program. As an alternative. 
ou may choose to save the file module to replace the existing module and a new scan of the hard drive will detect your 
les properly. Acommon example of this are certain camera RAW images that are sometimes found as TIFF images 
istead. 


ilelQ may not detect a suitable starting pattern for the sample files. If different programs create the same kind of file, it’s 
ossible the files with the same extension may not have the same starting pattern, and therefore won’t produce a usable 
3sult. For example, Quark and FreeHand programs both create EPS files, and if you took samples from both programs t 
reate a file module, FilelQ may report an issue because the programs create different formats for the files. You may 
onsider replacing some of the sample files with other files of the same type. For best results, use file samples that are 
reated from the same program, and preferably the program that produced the files you are looking for. 


here are cases in which FilelQ cannot create a file module. Some reasons a file module may not be created include: 


e The files are packaged file types. These are files that appear as a single file, but are actually folders with more 
data inside them. Since packaged files are made of multiple files, there is no method to reconstruct the file as a 
whole. Common examples of packaged files are Application bundles. 

e Inconsistent file patterns. These are files that do not have common file patterns that can be detected between th 
files due to different internal formats or raw data throughout the file. An example of this may include database files 

e Repetitive file patterns. These are files that have a common file pattern that repeats multiple times throughout th: 
file that a correct end of file cannot be determined. An example of this is a video file that has the same file pattern 
repeating every frame. This may result in a large number of single frame video files, but not a complete video. 
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» Manage Scans 


lata Rescue keeps the different scans that have taken place in its workspace. The Manage Scans feature allows you to 
ontinue a previously suspended scan or delete previous scans which are no longer needed. By keeping previous scan 
2sults in the workspace, Data Rescue allows you to return to the earlier scan results to recover additional files. 


he Choose Workspace feature also allows you to select a different location for the workspace folder. If the workspace 
ycation is changed, scans stored in the original workspace will no longer appear, but any scans stored in the new 
‘rorkspace will appear. If the workspace is changed back, the original scan results will once again appear. 


‘cans that are stored in the workspace are in a form that allows quick access to them. However, they can take up 
onsiderable space. The Manage Scans allows you to save one or more scans in a compressed .drscan file, after which 
ou could delete those scans from the workspace. Later if you want to restore any of those scans to the workspace, you 
an load them from the previously saved .drscan file. This also works for suspended scans. 


Manage SCANS aie resume save and import sans 


This window can be wsed to save the data analysis process (or scan) to a file and inaport existing files. Additionally 
you can delete unwanted scans and resume suspended scans. 


Workspace Macietosh HD (/Volermes /Macirtosh HD) 
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Manage Scans 


.1 Resuming Suspending Scans 
uspended scans may be resumed from the Manage Scans window. Ensure the same hard drive on which the scan was 
tarted is connected before resuming the scan. 

To resume a suspended scan: 


1. Click on File and select Manage Scans. 
2. Highlight the suspended scan. 
3. Click Resume. 


he previous scan will begin immediately and continue where the scan was suspended. 


1.2 Saving Scans 
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rimarily useful to archive scan results for access at a later time, or on the same computer setup, without taking up 
'rorkspace in the meantime. It could also be used when a scan needs to be continued on another machine. For example, 
onsider that an external hard drive has failed and a scan was started on a MacBook, but the user decided they needed 
vat MacBook for another purpose. The user may save the the scan file onto a separate device (such as a USB flash 
rive), connect the external hard drive to a different Mac computer, and import their scan with Data Rescue from that 
achine. 


here are restrictions when resuming or accessing a saved scan. The scan must be accessed by the same basic type of 
lac (PPC or Intel based), running the same major Mac OS version, and either the same or a compatible version of Data 
lescue. 


To save a .drscan file: 


Click on File and select Manage Scans. 

Highlight the scan(s) you want to save. 

Click on the Option (gearwheel) button on the bottom left corner and select Save As. 
Select a destination, title the file, and click on Save. 
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‘lease note that more than one scan can be saved, allowing you to archive multiple scan results into one .drscan file. The 
le must be saved on a separate device, not on the hard drive or volume that is missing the files. 


.3 Importing Scans 


S described in the previous section, a scan can be imported from a .drscan file. 


To import a .drscan file: 


Click on File and select Manage Scans. 

Click on the Option (gearwheel) button on the bottom left corner and select Import. 

Select the saved .drscan file and click on Open. 

A prompt will appear to “Choose Scans to Import”. Highlight the scans you want to load and click on Import. 
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he imported scans will be listed within the Manage Scans window. Once imported, you may select a suspended scan to 
ontinue, or go to the View menu and select Scan Results to view any completed scans. 


.4 Deleting Previous Scans 


lata Rescue archives all scans that it has completed within its workspace. These scans may take up several hundred 
1egabytes to gigabytes of space. After a scan is complete and the data has been recovered from the drive in question, 
ou may delete the previous scan from Data Rescue to reclaim the space on the hard drive. Deleting the scan is 
2commended only when the recovery process is completed. Once the scan results are deleted, the scan will need to be 
tarted from the beginning once again if further results were needed. 


To delete a previous scan: 


Click on File and select Manage Scans. 

Highlight the scan(s) you want to delete. 

Click on the Option (gearwheel) button on the bottom left corner and select Delete. 

A prompt will appear to confirm to delete the scan. Click on Delete to remove the scan. 
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1.5 Reviewing Previous Scan Results 


lata Rescue allows you to immediately review the results of any completed scans. This is very useful in case you have 
»rgotten to recover some files from the first attempt, or if you have to take a break from the recovery process. If more tha 
ne scan is completed, Data Rescue will list any previous completed scans as shown below. 


To review any previous scan results: 


1. Click on View in the toolbar and select Scan Results. 
2. If more than one scan was completed, select the completed scan from the list to load the results of the 
previous scan. 


the previous scan you wish to view is not visible, click and drag the little gray button in the middle of the left window are 
) the right until you can see the previous scan. Once the scan results have been reloaded, you may resume recovering 
ata from reloaded results. 
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) Drive Failure Detection 


lata Rescue can detect when a drive may be failing by analyzing the time it takes to read from the drive. If at any time it 
etects this, the Drive Failure Warning window will appear: 


Drive Failure Warning 


Data Rescue has detected slow read access to one or more of 
your drives, which may be a sign of a failing drive. More info. 


Drive Failure Warning 


t this point Data Rescue has detected slow read access on one or more of your drives, which may be a sign of a failing 
rive. If this persists, you have a few options: 


1. Stop the current task (scan, recovery, etc.) and perform a Clone. Cloning allows you to copy your drive to good 
drive. Data Rescue can then scan and recover off the good drive safely. 


2. Disconnect the drive from your computer, turn off its power (if applicable), and contact a data recovery company. 


3. Let the current task continue until completion (not recommended). 


_ Warning: Attempts to run a scan on your drive (if it is failing) for an extended period of time (e.g. days) may 
\, cause the drive to completely fail. This could prevent any data recovery company from being able to 
recover your data entirely. 


‘electing a drive and clicking Ignore will cause Data Rescue to ignore all further warnings on that drive until the 
pplication is relaunched. 


‘electing Details will provide a list of the sector (block) offsets and the time it took for Data Rescue to read from that 
ector. This is more useful for expert users such as data recovery technicians. 
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’ Preferences 


he Preferences menu is available under the Data Rescue 3 menu bar at the top of the screen. 


’.1 General 


he General preferences includes settings for the interface, expert features, actions when quitting or saving, checking fo! 
pdates, and resetting the warning dialogues. 


inable expert features will display a fourth section in the Preferences menu titled Expert. It will enable a variety of 
dditional features to help recover from advanced data recovery scenarios. The expert features are designed for 
xchnicians or experienced computer users. See Expert Features for more information about expert features. 


lisable animated user interface will turn off all animations within Data Rescue. Disabling the animated user interface is 
3commended if your computer has minimal memory or CPU speed. 


‘can Complete Sound and Recovery Complete Sound allows you to specify a specific sound to play when the scan o1 
3covery has finished. 


ypen Report on any error will open the Data Rescue Report window. Enabling this setting will allow you to immediately 
iew any of the errors that are reported by the program. 


‘heck for updates automatically will detect whether there are any new versions of the software available for download. 
his setting is enabled by default and will only check for updates if an internet connection is available. 


‘eset Warnings will reset all warning dialogs in Data Rescue where you can prevent the warnings from being displayed. 
or example, when quitting Data Rescue there is a confirmation dialog that shows which can be disabled from showing 
gain. When you reset all warnings, that dialog will appear again. 


’.2 Preview 


he Preview preferences include settings for Data Rescue’s preview feature while viewing found files. 


‘how Preview above other windows will keep the Preview window displayed at all times and prevent the window from 
eing hidden by other program windows. 


lake Preview opaque will remove the translucent effect from the Preview window when enabled. 


.uto-play audio and video files will immediately play any audio and video files when the preview window is opened for 
n audio or video file type. 


laximum auto-preview file size allows you to set the maximum size of a file that will be previewed automatically. By 
efault it is 10MB, so any file greater than this will not generate a preview until one is manually requested. 


witch to Data view when Preview is not available requires Expert Mode to be enabled in General preferences. 
Nnabling this setting will display the raw data for unrecognized file types in the Preview window. 


'.3 Scan Engine 


he Scan Engine preferences are additional settings for adjusting Data Rescue’s scan processes. Although there are 
any additional settings available, the default values should be fine for most situations and users, so changing these 
ettings should not be necessary. The Scan Engine preferences are available to provide extra flexibility for expert users 
nd in unusual circumstances where the default settings are not providing substantial results. 


he Scan Engine preferences are organized hierarchically and displayed as a tree. Highlighting a portion of the tree in the 
»ft- hand window will cause any associated properties and values to appear in the right- hand wingow: If you highlight a 
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eld that can change the value. If a property is not editable, it will be shown in a gray font (dimmed). To edit a ‘numerical G 
»xt value, double-click the current value, then type in the new value. 


or properties which represent file sizes, you can input a new value using KB, MB, or GB size shortcuts. For example, to 
pecify a size of 2 kilobytes, you can input either “2048” or “2KB”. 


he most common need to access the Scan Engine preferences is to increase the maximum file size for a certain file typ« 
then you expect to find very large files of this type. For example, the default maximum size for most movie file types is 
OGB. If you are looking for 25GB Quicktime movies, you will need to go into the preferences and increase the maximum 
le size to something larger than the biggest file you are looking for. 
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MPEC Description of selected property 
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Modifying Maximum File Size 


teset Scan Engine Preferences will changes all the Scan Engine Preferences back to default settings. This is useful if 
ou have previously changed any of the Scan Engine Preferences and would like to run based on the default 
onfigurations. 


he various scan engine preferences are discussed in the following sections. 
3.1 Cloning Preferences 


he Cloning Preferences are for advanced users who have special needs with regards to cloning. The default cloning 
trategy should be adequate for almost all users and situations. 


lata Rescue supports the following cloning strategies to help you accomplish this, which are described below starting wit 
1e simplest approach. 


itraight Copy — This straightforward strategy starts at the beginning of the source media, and sequentially copies buffer: 
f information to the destination media, one at a time, working straight through from start to end. If read errors are 
ncountered, the algorithm just keeps going through them sequentially. If the disk should happen to have an area of error 
lose to the start of the hard drive, this means the algorithm may spend many hours trying to work through this area, 
fithout having copied much data. 


leverse Copy — This strategy is nearly the same as the straight copy, except that instead of working from the start of the 
1edia to the end, it works from the end of the media to the start. In the aforementioned case where there were errors at 
1e beginning of the media, this strategy can help by allowing most of the data to be cloned before running into the 
roblem area. 


lisect Copy — This strategy is influenced by the detection of errors found during the clone process. The clone will start a 
1e beginning and clone until an error is encountered. Once an error is detected, the remaining space to clone is divided i 
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lone will return to the first half of the space to finish cloning. This process wil repeat as more errors are detected on the 
ard drive. 


‘egment Copy - This is the default cloning strategy that is similar to bisect copy, but provides a more elaborate and 
fficient method to clone the media. The space of the hard drive is divided into 64 pieces, which are further subdivided if 
rrors occur to ensure a clone of the healthy blocks of data while ignoring any bad blocks. If there are no errors, it will 
roceed exactly like the straight copy from the start to the end. 


lost users should just use the default segment copy. The Reverse Copy method can be useful if the user knows that mo: 
f the errors are near the start of the media. 


'.3.2 File Modules 


he reconstructed files that are found by Deleted Files Scan or Deep Scan are based on individual file modules. Each file 
10dule is responsible for detecting one kind of file. Most file modules have a number of preference properties in common 
uch as enable, maximum file size, etc. The file modules are grouped by category based on the file type. For convenienc 
ome of the properties for the individual file modules may be specified at the category level of the tree, which will allow all 
1e file modules of the same category to use the same values. Individual file modules may still override the values from tr 
ategory values. 
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File Modules Category 


.3.2.1 Top Level File Modules Preferences 


inabled specifies whether a module is enabled to look for files during a scan. The default enabled value for this node is 
’n. All the file modules underneath this point of the tree will be enabled, unless overridden at a lower level. 


lumber of filename digits controls how many numerical digits are used when generating names for files found by the fil 
10dules. For example, with the default setting of 5, the filenames will be generated as abc-00001, abc-00002, etc. 
‘hanging this setting to a value of 3 will generate file names as abc-001, abc-002, etc. The purpose of the leading zeros 
o the Finder will list these in numerical order. Setting this value to O will have no leading zeroes added to the file name. 


laximum file size controls the maximum size that certain files can be. If a found file exceeds this value, the file will be 
jnored. Not all file modules implement a maximum file size. 


.3.2.2 Category Level Preferences 


De te Me eS Dy oy Pamey Vw tries 


ategories are organized the same as the reconstructed file results. The preferences that are inherited from the top- -level 
le modules preferences are still shown so you can see their values, but are not editable (dimmed). 
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Non Editable Preferences 


.few categories have their own properties. For example, the Text category is disabled by default because its severe 
npact on performance and results. However, you may choose to enable the Text category if you want to scan for a 
articularly important text document that is not recovered by any other file module. 


ther examples of unique preferences include Maximum consec bad chars for Text file modules to help detect the end 
f a file properly and Minimum image dimensions for Video and Images. 


.3.2.3 File Module Preferences 


he lowest subcategory displays preferences for the individual file modules. The properties which are listed in green are 
references which are using a value from a higher place in the tree. 


".4 Recovery Preferences 


iad file color will add a label color of your choice to any files detected by Data Rescue that were potentially recovered a 
ad. The color label helps organize files when viewing them through the Finder. These bad files may be attributed to 
icomplete file patterns or incorrect allocation block layouts. 


‘hange ownership will change the file and folder ownership for all recovered files to the user running Data Rescue. This 
i helpful if the original hard drive was experiencing file ownership problems. 


‘lear lock will force change any lock bits when recovering files or folders when this preference is enabled. This will allow 
ny files or folders that were originally locked on the problem drive to be accessed, renamed, or deleted by the user. 


‘opy buffer size preference specifies the size of the buffer to use for copy operations, such as recovering files. A larger 
uffer size will improve the speed of the recovery of files, but will use more memory. 


lake items visible will change any invisible files to be visible when they are recovered. 
ymit empty files will ignore displaying any files that are indicated to have no data when enabled. 


‘ermissions promotion will change permissions of any recovered files to “Read and Write” based on the selected 
reference. 


e None will not change any permissions on any recovered files. 
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e For all items will change permissions of any recovered files. 


'.5 Scanning Preferences 


.eep bad files will keep all found files to be displayed in the scan results, even if they appear to have bad contents or 
mat. 


laximum files/folders preference is used during scanning when Data Rescue has to create its own folders using 


atalog files, such as the Orphans Folder within the Found Files results. When the number of files would exceed the valu: 
et in this preference, Data Rescue will create a new folder. The default is 1000 files per folder. 
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} Expert Features 


he expert features are designed for technicians or experienced computer users to help recover data in more complex 
3covery scenarios. Enabling expert features from the Preferences will display two new available options: an Expert tab 
fithin Preferences and an Expert drop-down menu in the tool bar. 


1 Expert Preferences 


he Expert Preferences provide management settings for Data Rescue’s file modules. The Expert Preferences are 
eparated into two additional tabs, Manage File Modules and Manage Conflicting File Modules. 


lanage File Module Definition Files will list any file modules added into Data Rescue by FilelQ and allows you to 
nable, import or remove file modules. This tab is primarily used to import customized file modules passed from technical 
upport in special case scenarios. 


lanage Conflicting File Modules will list any file modules that have file patterns in common. Some file types may be 
1istaken for use with another program or another version of the program. Clicking on a listed file module will display any 
ther file modules that were detected to have a similar file pattern. You may select a different file module to replace the 
urrent active file module to help ensure the file is found properly by Data Rescue. 


‘how Welcome screen at launch will always show the Welcome screen when Data Rescue starts up. Disable the 
heckbox if you prefer to not have this displayed and instead go directly to the Select Drive/Volume step. 


isk once per app session for the workspace will always ask for the workspace at least once per each app session (or 
iunch). If you prefer for Data Rescue to remember the workspace and not ask unless necessary, uncheck this box. 


he When quitting section has two drop down menus to note the default behavior of Data Rescue when exiting the 
pplication. 


he first drop-down menu selects what to do with the scan results when quitting: 


e Keep Scans — will leave scan results in the workspace. This is the default selection. 

e Delete Completed Scans — will delete previous scan results from the workspace. This is can be selected if you ar 
not concerned about your previous results, and want to free the disk space. 

e Show Manage Scans — will display the Manage Scans window before quitting the program. 


he second drop-down menu selects what to do with marked files from the Scan Results when quitting: 

e Unmark marked files — will unmark any files that were selected for recovery. 

e Leave marked files marked — will leave the marked files selected for recovery when loading those scan results. 
2 Expert Menu 
he Expert menu is available on the menubar at the top of the screen. 
2.1 Allocation Blocks Layout 
illocation Blocks Layout can be used after a Deep scan if the files listed by the Found Files results are not opening 
roperly after recovery. If none of the files open when they are first recovered, selecting this feature will provide you with 
dditional options which may correct the way the files are found. 
luring its scan, Data Rescue determines some possibilities for the proper Allocation Block Layout setup. The Block Size 


1e number of bytes of the allocation block. The Offset is the number of bytes (represented in hexadecimal), from the star 
f the media to the start of the file system. 
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3covered properly, try each of the other selections. 


To find the best allocation block layout for recovering files: 


1. Complete a Deep scan on the hard drive. 

2. At the results window, select a basic file (such as a JPEG image or text document) from the Found Files 
folder. 

3. Click on Preview to view the file. 

4. lf the file preview does not properly show the file, go to the Expert menu and click on Allocation Block 
Layout. 

5. Click on the next available selection inside the Allocation Block Layout window. 

6. Click on the results window. 

7. Select the same file and click on Preview to view the file. If the file opens correctly, try previewing a few 
other files to ensure they are viewed properly also. If multiple files begin opening correctly, this is a good 
indication the right Allocation Block Layout was selected. The files can be selected and recovered at this 
point. 

8. If the files do not open in the Preview window, repeat steps 5 through 7 until the file is opened properly in 
Preview. 


1 some cases, such as a drive you scanned had more than one partition or if there are remnants of older file systems stil 
resent on the disk, you will find that some files require one Allocation Block Layout selection and other files will require a 
ifferent selection. 


1.2.2 Choose Drive/Volume for Scan 


‘hoose Drive/Volume for Scan allows you to reselect the source hard drive or volume for any previous scan results in 
ase the original hard drive or volume was renamed or detected incorrectly. Selecting this feature will provide you with a 
st of connected hard drives or volumes to reference as the source. 


Choose Drive/Volume 


Choose the drive or volume on which this scan was originally performed. if not 
presem, attach the proper drive 


Choose Drive/Volume Window 


the correct hard drive is already detected, it will be listed by itself in the window. However, if more than one volume is 
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escription below the list will state any potential issues if the wrong media is selected. The selected media which shows 
1e least number of mismatched checksums and does not display any significant errors will be the ideal original source 
1edia. 


‘nable Show all drives and volumes to select any drive or volume, overriding Data Rescue’s filtered list based on the 
riginal drive/volume. 


To reselect the drive/volume for scan: 


1. At “Step 3: Find and Select Files”, highlight the scan results you want to reload. 

2. Select Choose Drive/Volume for Scan. 

3. Select the drive/volume that closely represents the original media scanned. Ensure the description has the 
least number of mismatched checksums. 

4. Click OK. 


nce the correct media is selected, you may continue with your recovery process from the results. 
2.3 Show Details 


ihow Details gives a simple count of the number of potential file starting points found during a scan, organized by file 
ype. The potential file starting points are not yet validated, so the ultimate number of files found by the end of the proces: 
‘ill be less (Sometimes dramatically less) than the number shown in the details window during the scan. The purpose of 
iis window is to give the user an estimate of what kinds of files are being found during the scan. 


1.2.4 Block Level Tools 


lata Rescue features block-level tools to display raw disk blocks. Most users will not need this feature, but advanced 
sers can use the block level tools to view absolute drive locations, such as viewing the partition table at the beginning of 
drive or viewing the data at the start of a file. 


To display a file’s block data: 


1. Highlight a file in the results window. 
2. Select New Window with this File’s Data/RSRC. 


he Logical block read depends on the allocation blocks layout. If the displayed data appears incorrect, try a different 
llocation block layout. The Allocation Block Layout window automatically updates any open block display windows, so 
ou can immediately see the effect of choosing a different Allocation Block Layout. 


he standard block window shows only the start of the file that was highlighted when you open it. You can open a special 
nspector’ version of the block window by holding down the Option key while selecting New Window with this File’s 
lata. When opened in this way, the block display window will show the all block information for the selected file. This 
llows you to quickly look at the the different blocks of data for the file. If the displayed data appears incorrect, try one of 
1e other Allocation Block Layout choices as described in the previous section. 


lew Window with Block # will display data at a specific block number on the hard drive. 


To display a block number’s data: 


1. Select New Window with Block #. 
2. Enter the block number to view. 
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data. 


2.5 Add File to Scan 
idd File to Scan allows a file to be added to the Source list and enables the file to be scanned for any additional data thi 
; a part of the file. This feature is especially helpful to help recover from damaged disk images that fail to mount. 

To add a file to scan: 


1. At “Step 1: Select Drive or Volume”, select Add File to Scan. 
2. Browse the Open window and highlight the file you want to scan. 
3. Click on Open to add the file to the Source list. 


’nce the file has been added to the Source list, you may proceed with the standard steps to scan the file. 
'.2.6 Set Drive/Volume Parameters 
‘et Drive/Volume Parameters is a feature that allows you to specify a starting and ending location and file system type 


r scanning. Using this feature manually sets parameters for the selected media. This is helpful if a hard drive’s partition 
ible was erased or damaged, but the file system and block size are known to simulate the original partition. 


Scan Start Sean | End 
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Display format: | Hexadecimal 5 


Set Drive/Volume Parameters 


lanually setting the hard drive / volume parameters requires technical knowledge of the media’s original settings to 
ffectively utilize this feature. 


here are several parameters that must be entered and selected: 


e Scan Start Block / Byte # is the first column of values that specifies the start point of the media where Data 
Rescue will begin its process. You may enter a value into either the Block # or Byte # field, which will then 
automatically fill in the other field with its respective value. 

e Scan End / Length allows you to choose whether you are scanning to a specific address (End), or to scana 
specific number of blocks/bytes (Length). Choose End if you know the ending address of the specific partition. 
Choose Length if you know the size of the partition. 

e Scan End Block / Byte # is the second column of values that specifies the ending address or length of scan 
depending on what selection you have made from the drop down menu. You may adjust the value in either the 
Block # or Byte # field, which will then automatically fill in the other field with its respective value. 

e File system allows you to specify what file system to detect within the block / byte range. You will want to select tr 
original file system that was used on the partition. 

e Display format allows you to choose the displaying values for the block and byte files to Hexadecimal or Decimal 
format. 
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To manually set the drive / volume parameters: 


1. At “Step 1: Select Drive or Volume”, highlight the hard drive or volume for which you want to change the 
parameters. 

Select Set Drive/Volume Parameters. 

Enter the Start Scan Block / Byte #. 

Select End or Length from the drop down menu. 

Enter the Scan End Block / Byte #. 

Select the File system from the drop down menu. 

Click on Set to apply the settings. 
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nce the parameters have been set, you may proceed with the standard steps to scan your hard drive. 
2.7 Add RAID Set 


dd RAID Set allows you to simulate a RAID configuration based on the RAID functionality built into Mac OS X. This is 
elpful in case an Apple RAID configuration fails to mount or be recognized as a single volume. Please note that Add 
‘AID Set does not attempt to fix or repair a RAID set. Instead, the RAID set is configured through Data Rescue for the 
urpose of scanning for data. 


RAID Type: | Stripe 


RAID Stripe Size: | 32K 


Ovag drives volumes to rearrange 


Cancel) ( Cominue — 


Add RAID Set 


dd RAID Set will not write any data to the hard drive, keeping the original state of the hard drives. This feature is 
pecifically intended to help simulate Apple software RAID configurations. Data Rescue attempts to setup the RAID 
ettings based on what it detects on the drives, so it may not be necessary to alter any settings when adding a RAID set. 


To add a RAID set: 


1. At “Step 1: Select Drive or Volume”, hold the command key while clicking on the hard drives in the list that 
are associated with the RAID volume. This will highlight multiple hard drives. 

2. Select Add RAID Set. This selection will be active only if two or more hard drives are highlighted. 

3. In the Add RAID Set list, drag the items in the list to rearrange the order of the hard drives / volumes from 
first to last. Data Rescue will automatically configure the order of the drives, and set the stripe size and 
RAID type according to what it sees on the drives. Only manually change the order, RAID type and stripe 
size if you know them to be incorrect, or have tried a scan with them using Data Rescue’s determined 
configuration and it didn’t work. 

4. Select the RAID type and RAID Stripe Size. If you are not using a Striped RAID, leave the Stripe Size as 
32KB. 

5. Click on Continue to add the RAID set. 

6. Anew selection in the Source list will appear as “RAID SET”. 


Ince the RAID set has been added, it can be selected to scan for data. In some cases, data mav not be opened properly 
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data is not being recovered properly from the RAID, we suggest the following steps to troubleshoot the issue: 


e Adjust the allocation block layout and reattempt the recovery until all options are exhausted or files are recovered. 
e Redefine the RAID Set by using Add RAID Set, and drag to rearrange the order of the hard drives / volumes. Data 
Rescue does not currently support editing an existing RAID set. To change the configuration, you must define a 

new RAID Set using the different parameters. 


lata Rescue supports 3 basic types of RAID, described very briefly below. 


tripe — This is also known as RAID-O. As data is read sequentially from the RAID set, it comes first from the first 
omponent drive until a stripe-sized amount has been read, then the next data comes from the second component drive, 
nd so on, in round-robin fashion. 


lirror — This is also Known as RAID-1. With this scheme, each of the drives is suppose to contain the exact same copy ¢ 
ata. This means that if you have an undamaged component drive, you should be able to just scan that to find your files 
/ou will not need to create a RAID set). 


‘oncatenated — This is not an official RAID level, but rather a way to make multiple hard drives appear as one big drive 
y concatenating them together. As data is read sequentially from the RAID set, it comes first from the first component 
rive, until the end of that drive is reached, then continues coming from the second component drive, and so on until the 
nd of the last component drive. 


he ordering of the component drives is mainly important for stripe and concatenated types. If this is wrong, the scan ma\ 
nd few or no good files. To alter the order, simply drag each drive in the list into its proper position. 


his RAID Stripe Size relevant for the Stripe RAID type, but irrelevant for the other types. The default and most common 
alue is 32KB. 


..2.8 Erase Drive/Volume 


tase Drive/Volume allows you to easily erase the selected drive or volume. This will only reformat the disk, not erase tr 
ontents of the disk. Drives are formatted as HFS+. If a volume is selected, only that volume will be reformatted. 
Mtherwise, the entire drive is reformatted and all existing volumes will be lost. 
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) Frequently Asked Questions 


he following chapter contains some commonly asked troubleshooting questions and their solutions or workarounds. If 
roblems still persist, contact Prosoft Engineering technical support. 


Jata Rescue seems to freeze. What should | do? 


lost cases of apparent freezing are actually slow reads due to disk problems. If Data Rescue runs into a disk area where 
1e disk is having trouble reading, it may appear to freeze, but actually just be very slow. If you think it has frozen, make <€ 
ote of what is being displayed on the progress display, for example, the block number, then check again in half an hour « 
o and see if it has advanced at all. If it progresses, it is probably just slow due to disk read problems. If you continue 
aving difficulties, make sure cables connecting to the disk drives are properly seated and consider disconnecting or 
Irning off any unnecessary devices connected to the computer. 


Vhy doesn’t my drive or volume show up? 


you have attached a drive with a damaged volume since you started Data Rescue, Data Rescue may not automatically 
otice it. Try the Expert > Refresh Volume List menu item. If the volume you are looking for still does not appear, it may bi 
ecause Data Rescue is unable to find the correct name for it, in which case it may show some other name such as 
Jnknown” for the volume name. Or it may be that Data Rescue can see the device, but is not able to recognize a volume 
tructure on the device. If that is the case, you will need to choose the device name for scanning rather than the volume. 


inally, it could be possible that your drive is malfunctioning to the point where your computer is not able to talk to it at all, 
1 which case even the device name will not appear. In this case, Data Rescue will not be able to scan your device. In this 
itter case, you might try some or all of the following things to see if your device can be made to appear: Double-check th 
rive cables and power source; remove/reattach the drive and/or power cycle it; power down and restart your computer. 
ou can also double check that the problem isn’t with the Data Rescue software itself by looking for your volume/drive 
sing Apple’s Disk Utility. If Disk Utility can see it, Data Rescue should be able to also; if Disk Utility can’t, then Data 
iescue won't be able to either. 


Vhy are some files listed twice? 


‘ometimes, your volume contains obsolete catalog entries. If Data Rescue finds two catalog entries with identical names. 
first checks if the two entries refer to the same data. If so, then the items are called “true duplicates”, and only one of 
1ese will be retained, and the other automatically removed. If the two entries refer to different data, both of them are 
stained, even if they have identical names and appear to be in the same directory, because there is no way to know 
'hich one is the correct one. To find which is the correct entry, check dates and file contents. 


Vhy do my found files total more than the size of the original drive? 
here could be a few reasons for this, as explained below. 


Vvhen you do a Deep scan, Data Rescue uses two different algorithms to locate files. These methods will often locate 
iany of the same files twice — once under the Found Files folder and again under the Reconstructed Files folder. (Data 
iescue does not currently have the capability to automatically cross correlate these sets of files, but may do so in a future 
ersion.) So if you elect to recover everything, it will often be the case that the total space required exceeds the original 
1edia size. 


he second reason why the found files may total more than expected is the possibility of anomalously (and incorrectly) 
irge files. In the course of scanning the media, Data Rescue will often come across bad files and catalog entries. Data 
'escue is able to filter out the vast majority of these bad entries, but not all of them. Occasionally a few of these may sho 
p in the recovery list with incorrect and large sizes. If you suspect this may be the case, you can easily find these large 
les by searching for files greater than a certain size using the Edit > Find menu item. A useful technique to eliminate 
1ese from the recovery is: first mark everything by clicking the checkbox for the top level folders, then search for and 
ncheck the large files which appear to be bogus. 
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lard linked files are used by Time Machine to store many copies of the same file with the same content, ‘without 
uplicating the contents. The current version of Data Rescue sees and recovers such files as individual files and does no 
hare space among the files when recovering. For example, if there are 20 hard links to a 1MB file on the original disk, 
nd you recover all 20 links, the recovered files will each take 1MB, or a total of 20MB. A future version of Data Rescue 
1ay alter this behavior. Until then, the best approach for this case is to select a single set of files to recover, such as the 
itest Time Machine backup folders rather than attempting to recover everything. 


Vhy is there a delay when I click the mark checkboxes? 


fter scanning a large drive, there may be hundreds of thousands or millions of files and folders to deal with. When you 
lick on a mark checkbox in the recovery list to mark or unmark files for recovery, especially the top-level folders, Data 
iescue has to walk recursively down through most of these items to individually mark or unmark them. The time this take 
; proportional to the number of found files. 


Joes Data Rescue handle RAID volumes? 


vith RAID, several component drives are set up to act logically as if they were a single composite drive. If your RAID 
rives or file system is in good enough shape that the system can still make them appear as a single logical drive, then 
lata Rescue should be able to scan that composite drive and recover files from it. 


the situation is such that the system cannot present the component drives as a single composite drive, then the answer 
epends on what kind of RAID your drives are set up to do. If the drives are set up to do mirroring (i.e. each file is stored 
ompletely on each mirror drive), then Data Rescue should be able to a Deep scan any of these component drives and 
cover files. 


the RAID is configured using Apple’s software RAID system, you may enable Expert features and use the Add RAID Se 
2ature to help simulate and scan the RAID. If the composite RAID device is visible without adding a RAID Set, it is almos 
lways better to scan that than to create a RAID Set and scan it. 


recovered files, but they won’t open. What’s wrong? 


he answer to this question depends on whether you're talking about files recovered from under the Reconstructed Files 
r Found Files Folder. 


iles recovered by catalog (i.e. from the Found Files folder) 

’s normal for a small percentage of recovered catalog files to be bad. But if you have checked a number of them and 
one of them are good, then chances are that they were recovered with the wrong Allocation Block Layout setting. Pick 
ut a few files to use as test files, and go back and select a different Allocation Block Layout choice and recover a few 
les. If you find an ABL setting that gives good results on those files, re-do your big recovery with that setting. 


iles recovered by content (i.e. from the Reconstructed Files folder) 

’s also normal for a small percentage of these files to be bad. If the original file was fragmented (not stored on disk in 
onsecutive blocks), then it can not be properly recovered by content. In most normal situations, most files on a user’s 
isk will not be fragmented. Typical fragmentation rates for files tend to be just a few percent. Note: The ABL setting plays 
o role in recovering files under the Reconstructed Files folder. 


>an | recover files that | deleted accidentally? 


1 OS X, when a file is deleted, for example by dragging it to the trash and emptying the trash, the file’s name and folder 
iformation is usually erased by the system, and is therefore irretrievably lost. However in most cases, the most importan 
art of the file — its contents — are still present on the disk. Finding the file by its contents alone is in general a difficult tas} 
3quiring algorithms to recognize those contents among all the billions of bytes of data on the disk. The Deleted File scan 
‘ill list over 150 major file types it detects based on its file patterns. 


Vhat are Data Rescue’s general content scan capabilities? 


1 generic technical terms, Data Rescue’s content scan is potentially suitable for any file type that consists of a single fork 
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‘escue has no means to connect the two pieces back together. Some “files” are in reality a collection of separate files 
‘hich the Finder treats like a single file. This is called a “bundle”. The individual components of a bundle may be 
3coverable by content scan, but again Data Rescue has no automated way to associate these components back togethe 
ito a bundle. 


in additional requirement for a successful recovery by content is that the file’s data not be fragmented. In other words, it 
iust be stored from beginning to end in consecutive media locations. Fortunately, most files get stored on disk that way. 
)S X tries to store files in a non-fragmented way when it can. Still it is typical for a small percentage of files to be 
agmented, and these will not recover properly when found by content. 


nportant: Do not mistakenly use a defragmentation utility (or any other program which will alter your disk) after losing 
our files, and prior to scanning with Data Rescue. Doing so will only make it less likely that you will be able recover your 
les. 


lote: The above limitations apply only to the files found by content. For files that are found by their catalog entries, the 
riginal bundles and forks may be properly recovered, and fragmentation is not an issue. 


specifically what types of files can Data Rescue find by content? 


he actual list of file types recoverable by content can be seen from within Data Rescue by going to the Data Rescue 
‘references menu and browsing through the File Modules tree. We expect to be adding to this list on an ongoing basis. 
or a recent list of filetypes recoverable by content, see the Release Notes file that came with your Data Rescue 
istribution. 


or any file types not supported by default, Data Rescue’s FilelQ feature will allow you to analyze sample files and 
ossibly generate a file module to help detect the files you are looking for. 
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illocation block: this is a block of file data within the file space of a volume. The size of allocation blocks is the same 
fithin a volume, but different volumes can have different allocation block sizes. This size is always a multiple of 512 bytes 
0 allocation blocks boundaries are always aligned with logical blocks. 


‘reator type: Associated with every file on a Mac is a four letter code that specifies the file’s creator. The creator is 
‘pically the application that created the file to begin with. This code is hidden from the user, but is used by the file systerr 
1 a number of ways. For one, along with the File type, it helps determine the icon to display for that file. In addition, when 
ou double click on a document, it is the application that has the same creator code as the document that will be launche: 
) open that document. 


ile type: Associated with every file on a Mac is a four letter code that specifies the type of file it is (e.g. ‘TEXT’ denotes <€ 
»xt file, ‘APPL’ denotes an application). On many other operating systems, the file type is part of the name; it is usually a 
ree-letter code following a period (e.g. myfile.txt or letter.doc). On the Mac, this code is hidden from the user but serves 
1e same purpose: to identify the kind of file. It uses the file type, along with the Creator type (see below) to determine the 
:on to display for a given file. 


IFS, HFS+: This stands for “Hierarchical File System” and “Hierarchical File System — Plus”. These are the names of 
pple’s proprietary File system layout for Mac OS computers. The newer, HFS+ system affords greater file and disk 
apacities, as well as performance improvements over that of the older HFS architecture. HFS+ was released with Apple’ 
.1 operating system and is designed to supersede HFS. All Mac OS versions from 8.1 Classic through OS X 10.x suppo 
oth HFS and HFS+. 


irphan: An orphaned file or folder is a file or folder which Data Rescue has discovered a catalog entry for, but no parent 
atalog folder can be found. Items like this are presented under the Orphans Folder in the Data Rescue recovery window. 


'‘hysical block: this is a 512-byte block of information on a physical device. Physical blocks start at zero so physical bloc 
0 is usually the first block of the partition map of a physical device. 


‘emote volume: A remote volume is a volume that is not directly connected to your computer. Typically a remote volume 


; a file server. If your Mac is not connected to a computer network (e.g. at your company), you probably don’t have 
ccess to any remote volumes. 
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lata Rescue can support any file type, if it is able to be found in an HFS catalog. Such files will appear under the “Found 
iles” folder in the recovery list. For files which have been deleted (and therefore have no HFS catalog entry), Data 
iescue supports finding files of a great many types by their content when doing a Deleted or Deep Scan. Such files will 
ppear under the “Reconstructed Files” folder in the recovery list. Below is a list of the file types supported for 
‘econstructed Files. In addition to these, other file types not on this list may often be recoverable with the new FilelQ 
2xature, using user-supplied sample files to teach Data Rescue about that type. 


nages: 


e JPEG 

e TIFF 

e PNG 

e GIF 

e Adobe Illustrator Al 

e EPS 

e RAW Camera Formats CRW, CR2, NEF, DCR, ORF, DNG, MOS, SRF, RAF, X38F, MRW 
e PSD 

e BMP 

e PCS 

e JPEG 2000 

e CaptureOne TIFF 

e Print Shop 

e MacDraft, MacDraw, MacPaint 
e PICT 

e InDesign 

e PCX 

e ICNS 

e ICO 


lovies: 


e QuickTime 

e MPEG-1/MPEG-2/MPEG-4 
e AVI 

e WMV 

e Flash SFW 

e Final Cut Projects 
e Raw DV 

e Cinema 4D 

e After Effects 

e MXF 

e M2TS/MTS 

e iMovie Project 


iudio: 


@: VVIMNV 


e MP3 

e AIFF 

e AAC/M4A/M4P/M4B 

° Ogg 

e Logic LSO 

e Finale Project 

e Maya Session 

e ProTools Session 

e Reason Session/Refill/Published/Recycle 
e Digital Speech Standard 


e Eudora 

e AppleMail 

e Outlook Express 

e Entourage database files 
e Raw EML/EMLX files 


locuments: 


e PDF 

e Word 

e PowerPoint 
e Excel 

e Quark 

e iWork ‘05 - ‘09 
e OpenOffice 

e Quicken 

e QuickBooks 
e AppleWorks/ClarisWorks 
e FreeHand 

e AutoCAD 

e EndNote 

e FinalDraft 

e InDesign 

e VectorWorks 
e ArchiCAD PLN and LBK 
e PageMaker 
e FileMaker 

e Word Perfect 
e Celtx Project 


e Generic ASCII Text TXT 
e RIF 


2. /NIVILL 


e HTML 
e Postscript (non-binary) 


irchives 


e Retrospect 

e Gzip 

e ZIP 

e RAR 

e BZip 

e Stuffit 

e DMG and Sparse Images 
e Java archives 


liscellaneous: 


e Resource forks 

e Property lists (binary and XML). Includes the following subtypes, recovered in various folders and with various 
extensions: Comic Life, Master Row, Soft Fill, |BCocoaFramework, ChatRoom, QCPatch, AudioTrack, CSElement 
Web archive, PmProj, Meta Model Key, User Model Key, Axis Limit, Safari bookmarks, and MyThought files. 

e Keychain files 

e OLE files (an older Microsoft Office format, includes generic OLE, Word, PowerPoint, Excel,) 

e Panorama 

e SQLite 

e PEF (a binary executable format) 

e QuickCeph (disabled by default) 

e Red One (R3D) files 

e Pro Tools Session Files 

e iTunes Music Library 

e Doom 3 save files 

e Adobe GoLive 

e FormZ v4 

e Cinema 4D 

e FinalDraft 

e HyperCard 

e Finale 

e Carrera Pro 4 

e 4D Database 

e iCal 

e Maya 

e Quicken 

e Now Up To Date 

e Now Contact 3 

e ProTools 

e AOL Filing Cabinet 

e Reunion-8 


e Lotus Notes Archive 

e Perl 

e PHP 

e TimeCard 

e Logic Pro 

e PowerSchool Database 
e Print Shop 

e Stickies 

e Address Book 

e Virtual PC7 

e EndNote 

e MacTracv6 

e Reason 

e AIM Chat 

e MaclnTax 

e TurboTax 

e Mozilla Bookmarks/Address Book 
e StatView 

e Easy Grade Pro3.6 

e Cubase 
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|2 Release Notes 


ersion 3.2.4 


e Fixed Deleted Files Scan for very large partitions 
e Fixed bug with recovering from multiple scans 
e Fixed crash while resuming a scan 


ersion 3.2.3 


Animated user interface is now disabled to improve OS X system stability 
Removed Analyze feature 


Changed default settings so recovered files do not retain original ownership and permissions 
“Parse HFS+ attributes” is now off by default 


ersion 3.2.2 


e Added Mac OS X 10.8 Mountain Lion compatibility 

e Added a newly designed application icon 

e Added support for recovering MIDI audio files 

e Added date to JPEG file names for those that contain EXIF metadata. 
e Added an “Open With” contextual menu for scan results. 


ersion 3.2.1 


e Added support for recovering Address Book’s database 

e Added support for recovering Celtx project files 

e Added suggested locations when selecting a recovery destination folder 
e Added ability to recover HFS+ extended attributes 

e Improved compatibility with Mac OS X 10.7 

e Improved VoiceOver compatibility 

e Fixed Photoshop PSDs with bit-depths other than 8 not recovering fully 
e Fixed incorrect sorting of scans after one was deleted 

e Fixed permissions on FilelQ .agfm files 

e Fixed total size calculation when Time Machine folders were marked 

e Fixed various crashes related to detecting bad drives 

e Fixed crash when Expert prefs were toggled after selecting Clone 

e Added RAID set partitions to device list 


ersion 3.2 


e Added support for recovering: 
© Microsoft Office 2011 documents 
© OpenOffice documents 
eo iWork ‘05-‘08 documents 
eo Photoshop large documents 
eo AutoCAD 2010/2011 documents 


Credits | 


Yo Uyy vuruis auuly ice 
© Apple and Windows icon images 
© Java Archives 
o AVCHD videos 
© AppleScripts 
o X8F and MRW raw images 
eo Encrypted sparse disk images 
© QuickBooks 2006-2011 company files 
oc EML messages 
o MPEG-2 videos 
o JPEG 2000 images 
o PICT images 
© Digital Speech Standard audio 
Improved support for recovering: 
ec Photoshop documents 
© DNG raw photos 
o ORF raw photos 
© QuickTime/MPEG-4 audio and video files 
o JPEG images 
o TIFF images 
Added option for Find to only search the selected folder 
Added warning for possible drive failure 
Added basic detection of ExFAT file systems in DR’s drives and volumes list 
Added new HTML help 
Improved search performance 
Improved handling of Preview while in demo mode 
Improved compatibility with VoiceOver 
Improved naming of attached disk images 
Improved FilelQ user interface responsiveness when processing large files 
Improved performance when browsing scan results 
Improved stability when running from a headless computer 
Improved compatibility with pre-release versions of Mac OS X 
Improved progress status information during Deleted Files Scan 
Fixed Data Rescue sometimes unnecessarily canceling a system restart, shutdown or logout 
Fixed “nulls” showing in the recovery step when performing multiple drag-and-drop recoveries in a row 
Fixed folders with extensions sometimes showing the wrong icon in Scan Results 
Fixed an error when trying to authorize a copy of the application 
Fixed a -4 error when deleting scans stored in the DVD’s Temporary Storage 
Fixed the Contents column in Detail View not properly updating if a drive was erased with a different partition type 
Fixed rare crash when canceling an Analyze 
Fixed rare crash when a search finishes 
Fixed completion audio improperly playing when a Clone or Analyze failed 
Fixed potential hang when browsing for files in FilelQ 
Fixed bug which prevented some MBR FAT82 partitions to not show up properly, which in turn caused any 
operation on the partition to fail immediately 
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Fixed rare crash in Clone when DR was unable to determine the length of the source device 


xpert-only changes: 


Added additional default RAID stripe sizes, and the ability to enter a custom value 

Added page up, page down, end and home key functionality to the Block viewer 

Added sorting to the Details window’s columns 

Added option to select any drive/volume for the Choose Drive/Volume for Scan window 

Added hard drive serial number to Details View for connection types that support it (e.g. eSATA, SATA, ATA). This 
replaces the Use Large Icons feature which previously displayed the BSD name. 

Fixed scan progress showing the max number of blocks instead of the ending block when the start offset was 
modified 

Fixed ejecting a RAID or File reporting an error. Now the RAID set or File is removed from the list. 


ersion 3.1 


‘nhancements: 


Runs natively as 64-bit on supported machines in Snow Leopard 

New Welcome window for easier access to suspended and completed scans 

Improvements to the Workspace and Home Folder workflows: now simpler to understand and use 
New Expert feature for erasing any drive or volume to HFS+ 

Added contextual menu to Details View for quick access to common features 

Improved recovery of InDesign, PEF raw image, TIFF and AVI files, for certain cases 

Added support for recovering certain ORF raw images 

A number of additional file types with no, or non-standard, extensions can now be previewed. 
DMG files with no partition table can now be found and recovered. 

Some improvements were made to improve Deep Scan results, in some cases. 

Some optional additional file browser columns may be shown by right-clicking on the table columns header. 


Catalog files with more than 8 fragments would sometimes be recovered incorrectly. 

Activation while launched from a read-only volume wouldn’t be applied correctly 

Erase wasn’t working on 10.4 

Erased drives wouldn’t show up in the source selection screen, sometimes causing unnecessary warnings to be 
displayed 

Erase wouldn’t work on a volume that was mounted while the open dialog was active 

Crash when attempting to erase a drive that just disconnected 

Rare crash when a device is disconnected 

Minor incompatibilities with the software update feature on 10.4 

Several usability enhancements to Set Drive/Volume Params. 

Arenas weren't rendering properly on Snow Leopard 

User interface preferences are now properly stored in the Home Folder for when booted off the DVD 
Fixed some bugs related to running the application on a secondary monitor 

Improved performance and stability while browsing scan results 

Analyze sometimes crashed just when finishing. 

When unmarking many nodes when quitting, the UI would seem to hang and show the beach ball. 
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e Windows-formatted drives (FAT32 and NTFS) can now be erased as Mac-formatted (HFS+) when choosing a 
workspace or recovery directory. This is useful for drives whose default format is not for the Mac. Erasing them is 
necessary to use them as a recovery drive for Data Rescue. 

e Sony raw image files (.srf and .arw) and Digital Performer project files are now properly found during scanning. 

e Preview can now process web archives and additional text files. 

e The Scan Results table now allows the user to reorder the columns. 

e Acrash which could occur if the source drive disconnects while doing an Analyze, Clone, or Recover. Now, a 
disconnect will cancel the operation and inform the user of the disconnect. 

e Acrash could occur if a defective drive reported a zero block size, or if the drive could not be opened for reading, « 
when trying to manually set size parameters for a defective drive. 

e Fixed crash when analyzing large files with FilelQ 

e Fixed various other crashes 

e Canceling a Recover would not cancel under some situations. 

e Under some circumstances, resuming a suspended scan could cause memory corruption in the scan engine 
process. 

e Certain types of QuickTime file contents could cause a single large file to be found as many small incomplete files. 

e Improved detection of AVI files. 

e Ifthe amount of free space on the workspace volume was small, it would sometimes display as a huge number. 

e Fixed a bug where scans in a workspace other than the default workspace sometimes weren't loaded at startup. 

e Some tiny invalid BMP image files were being included in the scan results. 

e Recovery animation was inefficient (updating more often than necessary). 

e Searching scan results by date was sometimes not working properly. 

e lf adrive was reported with a zero size, it was not being shown in the drives list. 

e The date on the Orphans Folder was incorrect. 

e The file Previewer was not responding to user changes to the Allocation Block Layout settings. 

e Preview’s process now runs as 64-bit in Snow Leopard on supported Intel machines. 

e Fixed issue with the Preview’s window able to move below the menu bar. 

e Command-Q now quits Data Rescue when Preview’s window is active. 

e The PKZip file module was erroneously showing as disabled in the FilelQ dialog. 

e The Node Inspector was showing the same file extents information incorrectly. 

e The Add RAID Set and Add File to Scan features were broken in version 3.0.1. 

e Fixed default date formats when booted from the DVD. 

e Addressed various problems with the status fields when scanning a slow drive or performing advanced clones. 

e Improved FAT32/NTFS volume name detection. 

e The “Refresh Volume List” menu has been moved from the Expert to File menu. 

e Reduced overall memory usage 


ersion 3.0.1 
e Fixes several crashes and bugs 
ersion 3.0 


e Data Rescue 3 runs on OS X 10.4.11 (Tiger) and later, including OS X 10.5.x (Leopard) and OS X 10.6.x (Snow 


Lovpaiu) 

e Data Rescue 3 sports a brand new Graphical User Interface, with animated visual effects. 

e Many (over 100) new Reconstructed file types have been added for Deleted and Deep scans. See the last section 
of this file for a current list of supported types. 

e A powerful new feature called FilelQ allows Data Rescue 3 to learn about new file types from user-supplied 
samples. This greatly extends the number of potential Reconstructed file types supported. 

e Anew File Previewer feature, which can preview many file types prior to recovery. 

e The ability to suspend and resume scans, and to manage the results from multiple scans. 

e Improved support for scanning Apple software RAID drives 

e Improved support for scanning large > 1TB drives 

e Improved support for recovering large sparse disk image files 

e Improved support for recovering pkzip files 

e Improved recovery of hard linked files 

e Added ability to unmount or eject a volume (useful when booted from DVD-ROM) 

e Automatic check for updated Data Rescue 3 version 

e Improved features to assist if a call to Prosoft technical support becomes necessary. 

e New Home Folder feature when booted from DVD; avoids the need to re-enter activation key each time it’s booted 

e Numerous bug fixes 
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‘ortions of the program use the following copyrighted material. 


e URLTextView by Aaron Sittig 


e RSVerticallyCenteredTextFieldCell by Daniel Jalkut 


e MGViewAnimation and MAAttachedWindow by Matt Gemmell 
e RBSplitView by Rainer Brockerhoff 
e StyledWindow by Jeff Ganyard 


e Sparkle by Andy Matuschak 
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